Android Banker Malware Evolves Through Accessibility Services Abuse

Android Banking Malware Is Turning Legitimate Accessibility Features Into an Attack Surface

Android banking malware continues to evolve by abusing legitimate operating-system capabilities, according to cybersecurity company Insomnia.

Its latest research focuses on a technique involving Android Accessibility Services, combined with real-time screen overlays. Insomnia says banking malware such as Hook and Chameleon can use this combination to interact with devices and target financial applications, including situations involving in-app 3DS challenges.

The research is based on field telemetry from Insomnia customer engagements over the last two quarters, according to the company.

Insomnia says the technique was first observed in its telemetry in Q1 2024 and has since appeared in 77% of the engagements tracked for this technique. The company also reports a 38x year-over-year increase and a 53% EDR bypass rate.

These figures are Insomnia's own telemetry measurements and should not be interpreted as independent industry-wide statistics.

Why Accessibility Services Are Attractive to Malware

Android Accessibility Services are legitimate system capabilities designed to help users interact with devices and applications.

That legitimate purpose can also create an abuse opportunity.

When malicious applications obtain accessibility-related permissions, they can potentially interact with elements of an application interface in ways that ordinary malware may not be able to achieve.

Insomnia's research focuses on the combination of Accessibility Services abuse and screen-overlay behavior. The company says this can allow Android bankers to interact with or manipulate the victim's view of financial applications.

The important security issue is not that Accessibility Services themselves are malicious. The problem is the potential misuse of a legitimate operating-system mechanism by malware.

Screen Overlays Add Another Layer to the Attack

Insomnia specifically highlights real-time screen overlays as part of the technique.

An overlay can place visual content above another application, creating opportunities for malware to influence what a user sees or interacts with.

In the context described by Insomnia, the overlay technique is combined with Accessibility Services abuse rather than being treated as an isolated capability.

This combination matters because defenders may need to correlate multiple behaviors rather than searching for a single malicious file or signature.

The source specifically says the technique can affect attacks even when banking applications use in-app 3DS challenges.

Insomnia does not provide additional technical details about the specific 3DS implementations involved.

Insomnia Reports a Sharp Increase in Observed Activity

The company's field telemetry presents four headline measurements:

These figures describe Insomnia's own engagement telemetry rather than a global measurement of Android malware.

The source does not provide the total number of engagements represented by the 77% figure, so the underlying sample size cannot be independently assessed from the announcement.

The Research Maps the Technique to MITRE ATT&CK

Insomnia maps the observed activity to three MITRE ATT&CK techniques:

• T1626.001 - Abuse Elevation Control - Device Admin

• T1417.002 - Credentials from Password Managers

• T1646 - Exfiltration Over C2

The mapping is intended to connect the observed behaviors with established adversary-technique classifications.

Because the source provides the technique identifiers but limited explanation for each mapping, this article does not infer additional behavior beyond the company's stated associations.

Why Signature-Based Detection Can Struggle

Insomnia argues that this class of activity is difficult to detect because it relies on legitimate system primitives rather than necessarily depending on obviously malicious files or processes.

The company says its behavior engine was retuned to correlate the specific sequence it observed and identify it as a high-confidence indicator.

This represents a different detection model from traditional signature-based security.

Instead of asking whether a known malicious file is present, behavior-based detection can look for a sequence of actions that becomes suspicious when those actions occur together.

Insomnia's Detection Comparison

The report categorizes detection effectiveness across four control families:

These ratings are Insomnia's own assessment and are not presented as an independent benchmark.

The company uses them to argue for behavior-chain detection when dealing with techniques that rely on legitimate operating-system mechanisms.

Indicators Security Teams Can Monitor

Insomnia identifies several indicators associated with the technique:

• Applications requesting BIND_ACCESSIBILITY_SERVICE

• Overlay permissions granted shortly after installation

• TalkBack events originating from non-system packages

The combination is more significant than any individual indicator.

For example, an application requesting accessibility capabilities may be legitimate. Likewise, accessibility events can be expected in normal assistive-technology scenarios.

The security relevance increases when unusual permission requests, overlay behavior and unexpected accessibility events occur together.

Observed Adversaries Listed by Insomnia

Insomnia also lists several adversaries and associated use cases in its research:

These actor associations are reported by Insomnia and should be treated as the company's assessment. The source does not provide additional evidence in the supplied material explaining each attribution.

The table also extends beyond the Android-banker framing in the article's opening, so the individual actor entries should not automatically be interpreted as evidence that every listed actor is using the exact same Android Accessibility Services technique.

Insomnia Provides a Detection Shortcut

The company provides command-line examples for hunting the technique and exporting detection rules.

# Sweep for this technique across the fleet

$ insomnia hunt --technique "mobile-malware-via-accessibility-services-banker-evolution" --since 30d

# Export YARA/Sigma rules bundled with this research

$ insomnia rules --export --technique "mobile-malware-via-accessibility-services-banker-evolution" --format sigma,yara

The first command is presented as a way to search for the specified technique over the previous 30 days.

The second command exports the YARA and Sigma rules associated with the research in the formats specified by Insomnia.

These commands are reproduced from the supplied source and are not independently tested here.

The Defensive Takeaway

Insomnia's central defensive recommendation is to focus on behavior chains rather than individual signatures for this category of activity.

That means security teams should consider correlating:

• Accessibility permission requests

• Overlay permission changes

• Unexpected accessibility events

• Application installation timing

• Suspicious application behavior

• Related endpoint or network activity

The company also recommends enabling its behavior engine through its EDR integration and using its layered detection capabilities.

For Android environments, this approach can be useful conceptually because legitimate accessibility capabilities can make simple allow-or-deny detection insufficient.

At the same time, legitimate accessibility applications and services can produce some of the same signals. Detection systems therefore need contextual analysis to reduce false positives.

Analysis: Mobile Malware Is Increasingly Abusing Legitimate Capabilities

The announcement highlights a broader security trend toward attackers abusing legitimate platform capabilities rather than relying exclusively on obviously malicious components.

Accessibility Services are a particularly important example because they exist to make devices easier to use. Their legitimate role means security teams cannot simply treat every accessibility-related event as malicious.

For defenders, this could mean greater emphasis on behavior correlation, permission context and application provenance.

The source also points to a broader lesson for endpoint security: a security product that depends heavily on known signatures may have less visibility when an attacker operates through trusted operating-system mechanisms.

However, Insomnia's detection-efficacy ratings are the company's own assessment, and the supplied report does not provide an independent comparative benchmark.

One Important Context Point

The article is framed around Android banking malware and Accessibility Services, but some of the technical workflow described later in the source refers to primitives including driver loading, OAuth consent and WFP filters.

Those mechanisms do not map cleanly onto the Android-specific framing introduced at the beginning of the report.

Rather than assuming additional technical relationships that the source does not explain, this article keeps those details attributed to Insomnia and focuses on the Android-specific indicators that the report explicitly identifies.

Additional details were not disclosed in the announcement.

Closing Notes

Insomnia's research describes an evolution in malware behavior where legitimate system capabilities can become part of an attack chain.

For Android banking threats, the company highlights the combination of Accessibility Services abuse and screen overlays, along with indicators such as accessibility permission requests, overlay permissions and unexpected accessibility events.

The report also recommends layered detection across network, identity and host controls and encourages customers to use its --layered-detect preset.

The larger defensive lesson is straightforward: when attackers operate through legitimate platform capabilities, security teams may need to look beyond signatures and investigate how multiple otherwise-normal behaviors combine into a suspicious sequence.